SharpTongue: pwning your foreign policy, one interview request at a time

Thursday 5 October 12:00 - 12:30, Red room 

Tom Lancaster (Volexity)

This talk walks through several years of spear phishing and malware, observed first-hand by Volexity, by a North Korean threat actor Volexity tracks as "SharpTongue". While this threat actor is often commonly referred to as "Kimsuky" in other public reporting, the Kimsuky moniker has grown over the years to include activity that we and others track as the work of distinct and separate threat actors.

We work with numerous individuals and defend the networks of several organizations that see a constant barrage of phishing attacks from SharpTongue. In some cases, the end goal is simply credential theft, but more commonly the goal is to install malware. From a social engineering perspective, SharpTongue is a grandmaster, using a range of tricks to gain a user's trust before any malicious link is sent or malware is delivered.

In addition to constant exposure to techniques used by attackers to infiltrate victim systems, we have also worked on several incident response cases where attackers have gained access to target systems, giving unique insight into their modus operandi after successfully breaching a system.

In summary, this paper provides a comprehensive overview of the threat actor's operations from head to tail, including the following:

• Numerous real-world examples of social engineering techniques used by SharpTongue that are unique to this threat actor and have not been publicly documented.
• A behind-the-scenes (and previously undocumented) view of how SharpTongue tries to protect its command-and-control (C2) servers and attempts to prevent security researchers from snooping on its activities.
• A complete view of the malware arsenal used by the group once a system is compromised.

• Download slides for this talk
• Download paper for this talk

Tom Lancaster Tom is the Threat Intelligence lead at Volexity, where he applies 10 years of threat intelligence, malware detection and incident response experience to help investigate and build knowledge repositories about sophisticated threats. He is a specialist in both investigating and tracking nation-state threat actors, as well as finding new ones. @tlansec

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers